A terminal service (TS) system allows a TS client to interact with an application being run on a remote TS server. A user who interacts with the application receives generally the same user experience that would be provided if the application were implemented locally by the TS client. Implementing the application on the TS server device affords a number of benefits. For instance, it may be easier to administer an application that is maintained at a central location.
In a first case, an organization (such as a corporation) may include a TS server that is accessible to a group of clients within the organization. In this scenario, the TS clients can access the TS server without special security provisions because the TS clients are presumed to be trusted entities. In a second case, the organization may wish to make its TS server available to another group of clients that are located outside the organization. For example, the organization may wish to allow employees to access its terminal server from their home via the Internet. In this scenario, the TS clients cannot access the TS server without special security provisions. According to one solution, the organization may use a gateway that sits behind a firewall to administer the interaction between external TS clients and the TS server.
However, there are potential vulnerabilities in above-described type of architecture. Consider the case of device redirection. In a TS system, device redirection allows a user who is interacting with a TS server to utilize devices that are associated with the TS server and devices that are associated with the TS client. For example, a user who is interacting with a word processing program that is being run on the TS server can specify that information is to be saved and retrieved from a storage device that is local with respect to the user's client device. This may allow a malicious user (or other entity) to potentially corrupt the data processing infrastructure of the organization by uploading viruses and the like to the TS server.
There is accordingly an exemplary need to improve the security of TS systems (and the like) that employ a gateway.